cybergate | c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
Size

685KB
MD5

23a17e73d6a1edf87ce73e376d49291e
SHA1

abcc76b693a19e3da149952813c9f99d549b83b3
SHA256

c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78
SHA512

e5c7ba752aab64b18c08cd4776e56293425dfaef141dbc902c3595cceae352cc3e88d008c8ba65520766c9770ca0960551b958ce9eb1b9b878caa960ddfc01b1
SSDEEP

12288:Lpjp8colcAUJmRpD1L4RPLlyu9K8Ua0qBDevSdJ0a1H0Ca:9VFoaAECBB4VL/9K8Ua0uxJbLa

Score

10^/10

cybergate remote persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

remote

mise1.zapto.org:999

Mutex

P27EG3I183525K

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
ftp_password
ª÷Öº+Þ
ftp_port
21
ftp_server
ftp.server.com
ftp_username
ftp_user
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
true
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{85S10766-KL76-GUJ2-XX3R-2W75AP67WIDA}	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85S10766-KL76-GUJ2-XX3R-2W75AP67WIDA}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe Restart"	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4568-134-0x0000000010410000-0x0000000010471000-memory.dmp	upx
behavioral2/memory/4568-140-0x0000000010480000-0x00000000104E1000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\directory\\CyberGate\\install\\server.exe"	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\directory\\CyberGate\\install\\server.exe"	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5092	4760	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80
PID 4568 wrote to memory of 3448	4568	c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe	80

C:\Users\Admin\AppData\Local\Temp\c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
"C:\Users\Admin\AppData\Local\Temp\c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe"
1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe
  "C:\Users\Admin\AppData\Local\Temp\c8967ba40f13c0f143f3e104395d53bb34b06e74e0f8e95ad720716f3bd62d78.exe"
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 252
    3⤵
    - Program crash
    PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4760 -ip 4760
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4568-132-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4568-134-0x0000000010410000-0x0000000010471000-memory.dmp

Filesize
388KB

Download
memory/4568-140-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/4568-143-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4760-139-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download